windbg.sys
Windows GUI symbolic debugger file version info
Driver on Windows LOLDrivers malicious 1 Sigma rule names it
A known malicious driver
https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/
17 known samples
Show the 17 samples’ SHA-256 hashes
10.0.19041.685 (WinBuild.160101.0800) · its entry
06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f10.0.19041.685 (WinBuild.160101.0800) · its entry
139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b98810.0.19041.685 (WinBuild.160101.0800) · its entry
32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d10.0.19041.685 (WinBuild.160101.0800) · its entry
4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a410.0.19041.685 (WinBuild.160101.0800) · its entry
50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c7610.0.19041.685 (WinBuild.160101.0800) · its entry
5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d10.0.19041.685 (WinBuild.160101.0800) · its entry
6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c72410.0.19041.685 (WinBuild.160101.0800) · its entry
6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b7710.0.19041.685 (WinBuild.160101.0800) · its entry
770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a10.0.19041.685 (WinBuild.160101.0800) · its entry
86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f6210.0.19041.685 (WinBuild.160101.0800) · its entry
bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df10.0.19041.685 (WinBuild.160101.0800) · its entry
e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d10.0.19041.685 (WinBuild.160101.0800) · its entry
e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d1210.0.19041.685 (WinBuild.160101.0800) · its entry
ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be62010.0.19041.685 (WinBuild.160101.0800) · its entry
f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b6012028010.0.19041.685 (WinBuild.160101.0800) · its entry
f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a10.0.19041.685 (WinBuild.160101.0800) · its entry
fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real windbg.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names windbg.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.